2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Staging"],"product":"Xperience","vendor":"Kentico","versions":[{"lessThanOrEqual":"13.0.178","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cisaActionDue":"2026-05-04","cisaExploitAdd":"2026-04-20","cisaRequiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Kentico Xperience Path Traversal Vulnerability","configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*","matchCriteriaId":"BC749CC3-7A20-49C8-89FB-775818670734","versionEndIncluding":"13.0.178","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178."},{"lang":"es","value":"Una ejecución remota de código autenticada en Kentico Xperience permite a los usuarios autenticados del servidor de sincronización de pruebas cargar datos arbitrarios en ubicaciones path traversal. Esto provoca la navegación de la ruta y la carga de archivos arbitrarios, incluyendo contenido que puede ejecutarse en el servidor, lo que provoca la ejecución remota de código. Este problema afecta a Kentico Xperience hasta la versión 13.0.178."}],"id":"CVE-2025-2749","lastModified":"2026-06-17T09:07:33.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2749","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-20T00:00:00+00:00","version":"2.0.3"}}]},"published":"2025-03-24T19:15:52.400","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://devnet.kentico.com/download/hotfixes"},{"source":"disclosure@vulncheck.com","tags":["Exploit","Third Party Advisory"],"url":"https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
|